6f1eb9c21b026eecfd65459ec4cffe3954d24619010741e18722108d7bacf3d1

Resubmissions

02-04-2024 06:55

240402-hp2xvaad7v 10

24-11-2022 08:04

221124-jybmpaad66 7

Analysis

max time kernel
47s
max time network
307s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
02-04-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SharkBot (15).apk
Size

14.9MB
MD5

cfe82625d3db2378994554ef7a2eba2b
SHA1

e511c4d99bfe0f8b47c32ea0c88b9d1024fbbd61
SHA256

6f1eb9c21b026eecfd65459ec4cffe3954d24619010741e18722108d7bacf3d1
SHA512

8742aab0ed45a1bc307a715d478acd7f6a37feb0029d4988496d27116c1907495476b4dfc98a997d0d3ae82971e44a20d2677861c0bede98c5806f2b2b78e27f
SSDEEP

393216:RPI3MBmacX7X52NWdXJq2TN51XIwUpObrfum7X9:RPIiqgY5xSOLX9

Score

7^/10

evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.sidalistudio.developer.app

ioc pid process

/data/user/0/com.sidalistudio.developer.app/cache/1616432909849.jar 4270 com.sidalistudio.developer.app
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.sidalistudio.developer.app

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.sidalistudio.developer.app
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.sidalistudio.developer.app

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.sidalistudio.developer.app

ioc	pid	process
/data/user/0/com.sidalistudio.developer.app/cache/1616432909849.jar	4270	com.sidalistudio.developer.app

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sidalistudio.developer.app

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.sidalistudio.developer.app

com.sidalistudio.developer.app
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
PID:4270

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sidalistudio.developer.app/cache/1616432909849.jar

Filesize
9KB

MD5
2c84bc0c28d4ac333d267f7a152b4039

SHA1
49e67f04004587ae351d5aba4da5f18644746864

SHA256
1eea5584eb2332554753b4beec7fe8e972bfb3eeadbe0c05dba33de267f25a00

SHA512
44ab6c390cac8b11bf43097293ef73bb620b1466fd671a945639198ea10dea425a0c9443b47752cc0a6689a6f5a7661b35f7a8a350ffcba30a72be60d5f18abd

Download Submit
/data/data/com.sidalistudio.developer.app/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.sidalistudio.developer.app/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8e7ead0f232601a77766db1142ca4dd3

SHA1
10566734f9074e05af9835759db60d1382646f6b

SHA256
a539fb7f154eb4f6be35d6a42d48eb7605340003720ed750d310760067ede329

SHA512
9bf65945e325d5e5745e9bf0a265c3f5a77ce53ca74a6dd168a580817e3db24d57a0aeb96911aa37f0fa45f90cac9fa27da45a741f0da66393c12c7062acacf4

Download Submit
/data/data/com.sidalistudio.developer.app/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sidalistudio.developer.app/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
34431213b139f22f42d58e77aa371c05

SHA1
da682593aefd670684921b23e426bd4b594c9090

SHA256
d123304c5e78bdce9ee34f716ec140fba7e183c948c283a1714e52fd185216f7

SHA512
9cc90a95144338a413aa4c30cd55f1c9119113b1eca9d64bcb79acd29ba8b97f4bba401843b4d4bfd71fa2dc4c732500154de8f1a0085e23a6bf7f3c3645bb90

Download Submit
/data/data/com.sidalistudio.developer.app/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0718e36c2ed05d94527547b565c95ceb

SHA1
296df480fbb53fc680df984e4b49fabc313800c2

SHA256
2cae347be150079815d41b1b9f165fecb55665b8971f50d42273423d4b23b8af

SHA512
a75463ad9be2c0d1f6f165305e7cb856434ef6ca78854156904486450aedcdbb36737f8d2d2cdc0d55df2a365e2640abbe75575021836382999232f6dc40b5d8

Download Submit
/data/user/0/com.sidalistudio.developer.app/cache/1616432909849.jar

Filesize
21KB

MD5
86ce3683020b3f28f4110aac9c769ff7

SHA1
876e0686440524927639a4797b2f13b12a26ce4a

SHA256
be852340e03b169a28811d1ff41582d19638d9fc0540f237ecb960c45bd07071

SHA512
04d03a9963ba49adf5d0d26a21b57e85e21416fcc3d479ce7522149d45f5ab630ff78e590e724695fe29850b08b4dccfa5051daf5d4e4afd9384f7183f887ddc

Download Submit